Publication Details

PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files

UHLÁR Juraj, HOLKOVIČ Martin and RUSŇÁK Vít. PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files. In: 2021 25TH INTERNATIONAL CONFERENCE INFORMATION VISUALISATION (IV): AI & VISUAL ANALYTICS & DATA SCIENCE. Sydney: IEEE Biometric Council, 2021, pp. 69-76. ISBN 978-1-6654-3827-8. ISSN 2375-0138.
Czech title
PCAPFunnel: Nástroj pro rychlé zkoumání souborů obsahujících zachycenou komunikaci
Type
conference paper
Language
english
Authors
Uhlár Juraj, Ing. (Flowmon)
Holkovič Martin, Ing. (DIFS FIT BUT)
Rusňák Vít, RNDr., Ph.D. (UVT MUNI)
Keywords

Data analysis, Data visualization, Network traffic analysis, Packet captures

Abstract

Analyzing network traffic is one of the fundamental tasks in both network operations and security incident analysis. Despite the immense efforts in workflow automation, an ample portion of the work still relies on manual data exploration and analytical insights by domain specialists. Current state-of-the-art network analysis tools provide high flexibility at the expense of usability and have a steep learning curve. Recent - often web-based - analytical tools emphasize interactive visualizations and provide simple user interfaces but only limited analytical support. This paper describes the tool that supports the analytical work of network and security operators. We introduce typical user tasks and requirements. We also present the filtering funnel metaphor for exploring packet capture (PCAP) files through visualizations of linked filter steps. We have created PCAPFunnel, a novel tool that improves the user experience and speeds up packet capture data analysis. The tool provides an overview of the communication, intuitive data filtering, and details of individual network nodes and connections between them. The qualitative usability study with nine domain experts confirmed the usability and usefulness of our approach for the initial data exploration in a wide range of tasks and usage scenarios, from educational purposes to exploratory network data analysis.

Published
2021
Pages
69-76
Journal
Proceedings, vol. 2021, no. 10, ISSN 2375-0138
Proceedings
2021 25TH INTERNATIONAL CONFERENCE INFORMATION VISUALISATION (IV): AI & VISUAL ANALYTICS & DATA SCIENCE
Conference
25th International Conference Information Visualisation, Sydney, AU
ISBN
978-1-6654-3827-8
Publisher
IEEE Biometric Council
Place
Sydney, AU
DOI
UT WoS
000850000500011
EID Scopus
BibTeX
@INPROCEEDINGS{FITPUB12556,
   author = "Juraj Uhl\'{a}r and Martin Holkovi\v{c} and V\'{i}t Rus\v{n}\'{a}k",
   title = "PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files",
   pages = "69--76",
   booktitle = "2021 25TH INTERNATIONAL CONFERENCE INFORMATION VISUALISATION (IV): AI \& VISUAL ANALYTICS \& DATA SCIENCE",
   journal = "Proceedings",
   volume = 2021,
   number = 10,
   year = 2021,
   location = "Sydney, AU",
   publisher = "IEEE Biometric Council",
   ISBN = "978-1-6654-3827-8",
   ISSN = "2375-0138",
   doi = "10.1109/IV53921.2021.00021",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/12556"
}
Back to top